1

I am trying to setup a remote connection (from anywhere in the world not just locally) to my Raspberry Pi 3. I want to do so without port forwarding, and without third party service (such as Weaved, or Digitalocean). Only using open-source software. I am even willing to pay for a dedicated domain and server if the solution requires it.

To describe what I have, take a look at attached image - my network configuration. I have a RPi3 at home with a static IP address. It is connected to a router (wlan0). And I want to connect to the RPi3 from "My laptop" - via SSH.

My network setup Possible solutions that I read on different forums: There is a possibility to establish a reverse ssh connection to my laptop. The problem is that my Home router's firewall won't any incoming connection go through - I don't want to open ports such as 3389.

My questions are:

  1. If I establish this reverse tunnel, is it possible for my laptop to connect to the RPi3 at any moment I want? Or do I need to implement it on the RPi3 as scheduled service and then I'd be able to connect only every hour or so?
  2. How can I implement this, theoretically.
0

The reverse tunnel should work. If you ssh with a reverse tunnel from your rpi to your laptop (the ssh connection0 then a port will be open on the laptop so that when you connect to said port of the laptop (either from the laptop itself or another computer that has access to the laptop, it really depends on how you try to set up the reverse tunnel and the ssh service restrictions on the laptop) then you will connect to some host/port on the rpi side (which very well could be some service of the rpi itself). This all depends on the laptop being reachable from the rpi. If your laptop has a public IP address then you should not have any problem at all.... however, if you are talking about connection to your laptop (or from your laptop with the ssh tunnel already set up, anyway) anywhere, even behind proxies and stuff (as in when you are at a private LAN), then you need both computers (rpi and laptop) on a different set up.

It might sound like an over kill but have you considered setting up a server on a VM provider so that you can access it with your rpi and your laptop so that they can see each other on a VPN? That should be enough.

  • If you want to poke a hole into the firewall and do not use port forwarding then the only solution is to use a third machine in the internet. I have rent the smallest possible virtual server at my provider for about 70 € a year. That's payable for the comfort and security the reverse tunnel has. I can connect all over the world to this virtual server and its secure encrypted entry point of the revers tunnel to my home server. – Ingo Jul 11 '18 at 1:21
1

First of all:

You MUST have an open port to connect to something. Anything else is like talking to someone's locked front-door instead of that person.

Reverse tunnelling:

This means that the Pi3 connects to something. Then orders that something to return traffic through that same connection.

This way you can talk to your Pi3 through that tunnel. Which in reality is a forwarded open port. Except for two things.

  1. The exposed socket is located at another external IP than your home.
  2. Traffic in the tunnel goes over shh, which should be encrypted. That means your ISP can't see what the packages contain.

Laptop vs 3rd party:

If your laptop has: 1. The same IP all the time (or a very fast ddns). 2. An ssh-socket exposed to the web.

Then you won't need a third party. The Pi3 can ssh (connect) to you, and then you use that connection to connect to what ever you want at home. If you don't have both those points sorted. You'll need a third party.

The third party:

Has to be somewhere that both your laptop and your Pi3 can connect to at any time. It has to be something that accepts ssh connections, and that can forward traffic both to, and from both the Pi and Laptop back through those connections.

Security:

If that third party has shitty security, you're better off forwarding an external port at home, to port 22 on the Pi3.

And securing the Pi3. Like allowing ONLY pubkey authentication, No external root logins. NO password logins. And setting options to ignore traffic (for an hour or two) from any IP with more than 5 or 6 failed login-attempts in 15 minutes (just an example).

Tunnel Persistence:

For the Pi3 to stay accessible, if you go with reverse-tunnelling, you can use something like autossh combined with cron-jobs. Perfect to keep the tunnel(s) up when possible. Even after reboots, the Pi3 will connect to it's target.

  • Clearly represented. Another issue is that a reverse tunnel pokes a hole in firewalls, not very liked by security manager. But to the reverse tunnel direct to the laptop: how tell I the raspi that it should connect? – Ingo Jul 27 '18 at 1:33
  • You can't connect without a hole in the firewall. That's what the firewall is there for. – svin83 Jul 30 '18 at 10:02
  • Crontab with "@reboot autossh....." works great. – svin83 Jul 30 '18 at 10:03
  • Why taking about crontab? That it works great isn't always true. On this site are many questions that it suddenly breaks. Man 5 crontab says: "Please note that startup, as far as @reboot is concerned, is the time when the cron(8) daemon startup. In particular, it may be before some system daemons, or other facilities, were startup. This is due to the boot order sequence of the machine." With systemd boot order sequence isn't defined and may change randomly. – Ingo Jul 30 '18 at 10:20
  • Lots of ways to work around this. crontab is reliable, but the boot order, as you mention, could pose a slight problem... Though it shouldn't be a problem if you enable wait for network in raspi-config (if I'm not mistaken?). I've certainly never had any problems. You could even use something like '@reboot sleep 120; autossh...' to be sure. This is an ugly hack imho, but will delay autossh for 2 minutes, and should ensure the system is up and running before starting autossh. – svin83 Jul 30 '18 at 15:36

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.